On Sun, Feb 23, 2014 at 2:19 PM, Sagi Grimberg <sa...@mellanox.com> wrote: > When unmapping request data, it is unsafe automatically > decrement req->nfmr regardless of it's value since IO and > reconnect flow may run concurrently resulting in req->nfmr = -1 > and falsely call ib_fmr_pool_unmap.
punctuation... I think 1-2 commas are missing here > > Fix the loop condition to to be greater then zero (which > explicitely means that FMRs were used on this request) > and only increment when needed. s/then/than/ s/explicitely/explicitly/ > > This crash is easily reproduceable with SRIOV OR Connect-IB > (where FMRs are not supported) s/SRIOV/ConnectX VFs/ > > Signed-off-by: Sagi Grimberg <sa...@mellanox.com> > --- > drivers/infiniband/ulp/srp/ib_srp.c | 5 ++++- > 1 files changed, 4 insertions(+), 1 deletions(-) > > diff --git a/drivers/infiniband/ulp/srp/ib_srp.c > b/drivers/infiniband/ulp/srp/ib_srp.c > index 529b6bc..0e20bfb 100644 > --- a/drivers/infiniband/ulp/srp/ib_srp.c > +++ b/drivers/infiniband/ulp/srp/ib_srp.c > @@ -766,8 +766,11 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd, > return; > > pfmr = req->fmr_list; > - while (req->nfmr--) > + > + while (req->nfmr > 0) { > ib_fmr_pool_unmap(*pfmr++); > + req->nfmr--; > + } > > ib_dma_unmap_sg(ibdev, scsi_sglist(scmnd), scsi_sg_count(scmnd), > scmnd->sc_data_direction); > -- > 1.7.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html